Brussels: The Digital Omnibus took a step forward on 21 October 2026, when member states agreed the Council’s negotiating mandate on simplified data protection and privacy rules. The text lets companies take up to 96 hours to report a personal data breach, instead of the current 72 hours, and it trims the cookie banners that irritate internet users.
Ambassadors in the Permanent Representatives Committee approved the mandate, and the Council published the document on 22 October. The Commission proposed the Digital Omnibus on 19 November 2025 under procedure 2025/0360(COD). The mandate is a Council position only. Parliament has not adopted its own text, so trilogue talks have not started, and the institutions aim to finish all simplification packages by the end of 2027.
On breaches, the Digital Omnibus text would limit notification to incidents that are likely to result in a high risk for people. Controllers would report where feasible within 96 hours and explain any delay, and they would still have to document every breach. The European Data Protection Board would publish two lists, one of circumstances that probably create high risk and one of circumstances that do not. The same lists would decide when companies must tell the people affected.
Cookies stay in the ePrivacy Directive rather than moving into the GDPR. The Digital Omnibus position adds exemptions from consent for anonymous audience measurement by the service provider, device security, and measuring contextual advertising without profiling. Users must be able to refuse with a single click, and a site may not ask again for the same purpose for at least four months. Because the ePrivacy rules sit in a directive, national parliaments would get a 24-month transposition period.
Other changes affect everyday compliance work. The Council keeps the legal definition of personal data but adds a provision on pseudonymised data, which a third party that cannot identify the person would not treat as personal data. Controllers could refuse access requests as excessive where abusive intent is shown, and they would carry the burden of proof. A single EU list would replace 27 national lists of processing operations that need a data protection impact assessment. Legitimate interest could also cover developing and operating an AI system, judged case by case, with a right to object.
Businesses welcome the lighter touch, yet privacy advocates see risk in the Digital Omnibus. Companies say a longer deadline and a high-risk threshold reduce notification noise for supervisors. Critics answer that fewer notifications mean fewer chances for people to protect themselves after a leak, and that the pseudonymisation clause may open loopholes. Data protection authorities, including the Irish regulator in Dublin that oversees many large technology firms, will watch how the high-risk lists work in practice.
Parliament now holds the next move. Its committees must agree a position and then negotiate with the Council and the Commission. The final Digital Omnibus could differ sharply from the Council text, especially on cookies and the treatment of AI training data, so companies should prepare for change rather than treat the 96-hour deadline as settled law.
